Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    728KB

  • MD5

    440d80177fde6f98a55bf5f7e0bae9fb

  • SHA1

    ce0fb0341893d810d1e91cab5d2867794df8edb0

  • SHA256

    49684dec204eb2dbc2279a2acb9cd3bc5aca5d101d004549584b6fd8ca59a770

  • SHA512

    2912038bef0536da4247d33fcd6166b0b44fc210e882786c4e91066e3a4ac4d8ebe84e3716726059319ddf06ac820b7348781cfaadd316793c1f23cbbe4fda14

  • SSDEEP

    12288:8Mrxy90Od69E0D8icBvrToDMM8/rzsHStueJU641diMOKrVrrogURsU0LddG:dyBd69EaQbdrzsy1U6sdiMOQ5Ugwj6dG

  Score

  10^/10

  amadeyredlinedunmromikdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2